Skip to content
OpenAdvisories

Vendor

N-Media

39 known vulnerabilities.

Products

Frontend File Manager Plugin 13 Frontend File Manager 6 Simple User Registration 6 Admin and Customer Messages After Order for WooCommerce: OrderConvo 3 Bulk Product Sync 2 Comments Extra Fields For Post,Pages and CPT 2 Website Contact Form With File Upload 1 Nmedia MailChimp 1 Easy Quiz Maker 1 GoHero Store Customizer for WooCommerce 1 N-Media Post Front-end Form 1 Personalized WooCommerce Cart Page 1 2Checkout Payment Gateway for WooCommerce 1 OrderConvo 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.1
    CVE-2026-32577

    WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

    N-Media Frontend File Manager
  • High 8.1
    CVE-2026-8095

    Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

    The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update …

    N-Media Frontend File Manager Plugin Web / CMS
  • High 7.5
    CVE-2026-1280

    Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter

    The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated att…

    N-Media Frontend File Manager Plugin Web / CMS
  • High 8.8
    CVE-2026-0844

    Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field

    The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minima…

    N-Media Simple User Registration Web / CMS
  • High 7.2
    CVE-2025-12160

    Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting

    The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for u…

    N-Media Simple User Registration Web / CMS
  • High 8.8
    CVE-2025-53428

    WordPress Simple User Registration plugin <= 6.8 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.

    N-Media Simple User Registration
  • High 7.5
    CVE-2023-7306

    Frontend File Manager <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

    The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthentica…

    N-Media Frontend File Manager Plugin Web / CMS
  • High 7.2
    CVE-2021-4365

    Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting

    The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX act…

    N-Media Frontend File Manager Plugin Web / CMS
  • High 7.2
    CVE-2021-4350

    Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails

    The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for una…

    N-Media Frontend File Manager Plugin Web / CMS